Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6978-1 advisory.

    It was discovered that XStream incorrectly handled parsing of certain crafted XML documents. A remote     attacker could possibly use this issue to read arbitrary files. (CVE-2016-3674)

    Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker     could run arbitrary shell commands by manipulating the processed input stream. (CVE-2020-26217)

    It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could     request data from internal resources that are not publicly available only by manipulating the processed     input stream. (CVE-2020-26258)

    It was discovered that XStream was vulnerable to arbitrary file deletion on the local host. A remote     attacker could use this to delete arbitrary known files on the host as long as the executing process had     sufficient rights only by manipulating the processed input stream. (CVE-2020-26259)

    It was discovered that XStream was vulnerable to denial of service, arbitrary code execution, arbitrary     file deletion and server-side forgery attacks. A remote attacker could cause any of those issues by     manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344,     CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350,     CVE-2021-21351)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.10.1. It is, therefore, affected by multiple vulnerabilities:

  - Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may     allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when     unmarshaling XML or any supported format. e.g. JSON. (CVE-2013-7285)

  - Multiple XML external entity (XXE) vulnerabilities in the Dom4JDriver, DomDriver, JDomDriver, JDom2Driver, SjsxpDriver,     StandardStaxDriver, and WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files     via a crafted XML document. (CVE-2016-3674)

  - XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance     of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by     an xstream.fromXML call. (CVE-2017-7957)

  - The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite     loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose     the file names inside of an archive created by Compress. (CVE-2019-12402)

  - The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1     allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. (CVE-2019-20104)

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the     httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. (CVE-2020-15586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that XStream, a Java library to serialize objects to XML and back again, was susceptible to XML External Entity attacks.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.2-1+deb7u1.

We recommend that you upgrade your libxstream-java packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that XStream, a Java library to serialize objects to XML and back again, was susceptible to XML External Entity attacks.

Security fix for CVE-2016-3674

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
206123	Ubuntu 14.04 LTS / 16.04 LTS : XStream vulnerabilities (USN-6978-1)	Nessus	Ubuntu Local Security Checks	critical
144307	JFrog < 7.10.1 Multiple Vulnerabilities	Nessus	Misc.	critical
91521	Debian DLA-504-1 : libxstream-java security update	Nessus	Debian Local Security Checks	high
91110	Debian DSA-3575-1 : libxstream-java - security update	Nessus	Debian Local Security Checks	high
90739	Fedora 23 : xstream-1.4.9-1.fc23 (2016-de909cc333)	Nessus	Fedora Local Security Checks	high
90727	Fedora 22 : xstream-1.4.9-1.fc22 (2016-250042b8a6)	Nessus	Fedora Local Security Checks	high
90327	Fedora 24 : xstream-1.4.9-1.fc24 (2016-175b56bb05)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2016-3674

high

Tenable Plugins

critical

critical

high

high

high

high

high